The present disclosure relates to computing systems, and in particular to maintaining the security of computing systems in virtual operating environments.
Virtualized computing environments, also referred to as cloud computing systems, are used to provide computing resources to end users. In a cloud computing environment, the physical hardware configuration is hidden from the end user. Cloud computing systems may include servers, network storage devices, routers, gateways, communication links, and other devices. However, because the physical hardware and software platforms on which cloud computing system is implemented are hidden within a “cloud,” they can be managed, upgraded, replaced or otherwise changed by a system administrator without the customer being aware of or affected by the change.
In a typical cloud computing environment, applications may be executed on virtual machines, which are isolated guest operating systems installed within a host system. Virtual machines are typically implemented with either software emulation or hardware virtualization, or both. A single hardware and/or software platform may host a number of virtual machines, each of which may have access to some portion of the platform's resources, such as processing resources, storage resources, etc.
Because cloud computing treats computing resources as remote services that are accessed by customers, and because the actual physical resources that are used to implement a cloud computing environment may be accessed by many different customers, security is an important aspect of cloud computing.
Many different technologies have been developed to prevent security breaches in computing systems. For example, the physical security of computing systems can be addressed by locating the computing systems in a secure facility. Communication links can be encrypted or secured to prevent eavesdropping on communications with computing resources. Application programs and databases can be secured using authentication protocols to prevent unauthorized access.
Many security systems and procedures have an overhead cost associated with their use. For example, encrypting and decrypting communications requires time and computing resources, particularly for high volume communications. A system designer must therefore make a tradeoff between the level of security required for the system and the amount of overhead expense that can be tolerated. Depending on the sensitivity of the application, computing systems can be provided with varying levels of security.
In a cloud computing environment, different customers may have different security requirements. Hosting applications that have different security requirements in a single cloud computing system may raise additional security issues, however. For example, when highly secured systems are hosted along with lower security systems, an attacker may attempt to leverage the lower security system to gain access to the highly secured systems.